My goal is to provide always on VPN access to a device connected via Ethernet.
I have set up an openwrt Proxmox container as a Wireguard Client. The openwrt WAN interface is connected to vmbr0 (local lan) and openwrt LAN to vmbr1 (usb Ethernet adapter).
I have Internet access on the openwrt router itself (connected to my home router or via Wireguard). I can run diagnostics successfully and can install packages.
I cannot access the Internet from any device which I connect to the LAN port / vmbr1. I get an IP address assigned via DHCP and everything looks ok as far I can tell.
Any suggestions on how I could resolve this issue?
Using a kvm backend would make your setup a lot easier, as you'd no longer depend on your host's kernel to provide essential functionality (e.g. wireguard) in the right way (systcl, sysfs knobs all tuned as expected by OpenWrt).
It might be an issue with the firewall or something else. I can access Luci from the WAN interface as soon as I boot the container. Normally this is blocked. I've used an lxc/lxd image from here https://uk.lxd.images.canonical.com/images
Thank you.
Got the same Issue, the LXC Container itself can reach the internet. The Clients on the LAN can reach the Gateway and can Lookup DNS but ping is not working. It seems the OpenWRT is not routing.
Its setup on a VPS Server so i only can use LXC and i only got on IP Adress.
Here is my Proxmox Interfaces
auto lo
iface lo inet loopback
iface ens3 inet manual
auto vmbr0
iface vmbr0 inet static
address XXX.XXX.XXX.171/22
gateway XXX.XXX.XXX.1
bridge-ports ens3
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m multiport ! --dport 8006 -j DNAT --to 10.0.0.2
post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp -j DNAT --to 10.0.0.2
auto vmbr1
iface vmbr1 inet static
address 10.0.0.1/30
bridge-ports none
bridge-stp off
bridge-fd 0
post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/30' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/30' -o vmbr0 -j MASQUERADE
#WAN
auto vmbr2
iface vmbr2 inet static
address 192.168.5.2/24
bridge-ports none
bridge-stp off
bridge-fd 0
#LAN
root@ct-openwrt:/# cat /etc/config/network
config interface 'loopback'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option device 'lo'
config interface 'lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.5.1'
option device 'br-lan'
list dns '192.168.5.1'
config interface 'wan'
option proto 'static'
option ip6assign '60'
option ipaddr '10.0.0.2'
option gateway '10.0.0.1'
option device 'eth0'
list dns '8.8.8.8'
list dns '1.1.1.1'
option netmask '255.255.255.252'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'